{"record":{"id":"0527ddfb2b8d11b4","repo":"dotnet/runtime","slug":"could-not-find-checksum-for-path-in-release-file","errorCode":null,"errorMessage":"Could not find checksum for {path} in Release file.","messagePattern":"Could not find checksum for (.+?) in Release file\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"eng/common/cross/install-debs.py","lineNumber":154,"sourceCode":"\n        print(\"Signature verified successfully.\")\n\n        with open(release_file.name) as f:\n            return f.read()\n\ndef parse_release_file(content, path):\n    \"\"\"Parses the Release file and returns sha256 checksum of the specified path.\"\"\"\n\n    # data looks like this:\n    # <checksum>  <size>  <path>\n    matches = re.findall(r'^ (\\S*) +(\\S*) +(\\S*)$', content, re.MULTILINE)\n\n    for entry in matches:\n        # the file has both md5 and sha256 checksums, we want sha256 which has a length of 64\n        if entry[2] == path and len(entry[0]) == 64:\n            return entry[0]\n\n    raise Exception(f\"Could not find checksum for {path} in Release file.\")\n\ndef parse_debian_version(version):\n    \"\"\"Parse a Debian package version into epoch, upstream version, and revision.\"\"\"\n    match = re.match(r'^(?:(\\d+):)?([^-]+)(?:-(.+))?$', version)\n    if not match:\n        raise ValueError(f\"Invalid Debian version format: {version}\")\n    epoch, upstream, revision = match.groups()\n    return int(epoch) if epoch else 0, upstream, revision or \"\"\n\ndef compare_upstream_version(v1, v2):\n    \"\"\"Compare upstream or revision parts using Debian rules.\"\"\"\n    def tokenize(version):\n        tokens = re.split(r'([0-9]+|[A-Za-z]+)', version)\n        return [int(x) if x.isdigit() else x for x in tokens if x]\n\n    tokens1 = tokenize(v1)\n    tokens2 = tokenize(v2)\n","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/dotnet/runtime/blob/60108ba66eb7d1d12f595480091b4ad80a24b172/eng/common/cross/install-debs.py#L136-L172","documentation":"parse_release_file walks the SHA-256 checksum block of the Release file looking for an entry whose path matches the requested file (e.g. main/binary-arm64/Packages.gz) and whose checksum field is 64 hex chars. If none is found, the script cannot verify that file's integrity and throws rather than trusting an unverified download.","triggerScenarios":"With --force-check-gpg, fetch_and_decompress asks parse_release_file for the checksum of a Packages.gz path that is not listed in the Release file. Raised at install-debs.py:154. Happens when the component/suite/arch combination does not exist (e.g. requesting 'universe' on a Debian mirror, or a non-existent arch).","commonSituations":"Wrong --suite (e.g. a release that does not ship the requested component). Wrong --arch (requesting loong64 on a mirror that does not carry it). Component mismatch (requesting 'universe' on plain Debian, or 'main' only on Ubuntu when the package is in 'universe'). Mirror that strips checksum entries.","solutions":["Confirm the component exists for the suite/arch by inspecting the Release file (look for the main/binary-<arch>/Packages.gz SHA256 line).","Match --arch to a real arch on the mirror (amd64, arm64, armhf, i386 on Debian; ports mirror for loong64/riscv64).","If using a suite without that component, switch --suite to one that has it.","Inspect the downloaded Release file to confirm it is well-formed (not an HTML error page from a misconfigured mirror)."],"exampleFix":"# before\npython3 install-debs.py --force-check-gpg --suite bookworm --arch loong64 --mirror http://deb.debian.org/debian ...\n# Could not find checksum for main/binary-loong64/Packages.gz\n\n# after\npython3 install-debs.py --force-check-gpg --suite sid --arch loong64 --mirror http://ftp.ports.debian.org/debian-ports ...","handlingStrategy":"validation","validationCode":"# Pre-flight: confirm the Release file lists the requested path before building.\nimport re\ndef release_lists_path(release_text: str, path: str) -> bool:\n    matches = re.findall(r'^ (\\S{64}) +\\S+ +(\\S+)$', release_text, re.MULTILINE)\n    return any(p == path for _, p in matches)\n\n# Fetch <mirror>/dists/<suite>/Release, check for main/binary-<arch>/Packages.gz.","typeGuard":null,"tryCatchPattern":"try:\n    main()\nexcept Exception as e:\n    if 'Could not find checksum' in str(e):\n        print('Requested component/suite/arch not present in Release; fix --arch/--suite/--mirror.')\n        sys.exit(2)\n    raise","preventionTips":["Confirm the component (main/universe) exists for the suite/arch on the mirror.","Use the ports mirror for non-mainstream arches (loong64, riscv64, etc.).","Inspect the Release file in CI before the full rootfs build."],"tags":["dotnet-rootfs","debian","release-file","gpg","integrity","python"],"backgroundTag":null,"analyzedSha":"60108ba66eb7d1d12f595480091b4ad80a24b172","analyzedAt":"2026-08-10T18:54:11.478Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}